逆WIN7X64内核调试体系之NtDebugActiveProcess

来源：互联网发布：淘宝整机哪家靠谱编辑：程序博客网时间：2024/04/29 17:00

NTSTATUS __fastcall proxyNtDebugActiveProcess(HANDLE ProcessHandle, HANDLE DebugObjectHandle){
PMY_OBJECT_TYPE object;
PMY_OBJECT_TYPE debugobject;
OBJECT_HANDLE_INFORMATION objecthandleinformation;
NTSTATUS status;
PETHREAD LastThread;
status=ObReferenceObjectByHandle(ProcessHandle, 0x800, PsProcessType, UserMode, &object, &objecthandleinformation);
if (NT_SUCCESS(status)){
if (object == PsGetCurrentProcess() || object == PsInitialSystemProcess){

ObfDereferenceObject(object);
status = STATUS_INVALID_HANDLE;
}

}

status = ObReferenceObjectByHandle(DebugObjectHandle, 0x2, NewDbgObject, UserMode, &debugobject, &objecthandleinformation);

if (!NT_SUCCESS(status)){

status = STATUS_INVALID_HANDLE;
ObfDereferenceObject(debugobject);
ObfDereferenceObject(object);

}
else{
if (ExAcquireRundownProtection((PEX_RUNDOWN_REF*)(object + 376))){

((pfnDbgkpPostFakeProcessCreateMessages)DbgkpPostFakeProcessCreateMessages)(object, debugobject, &LastThread);
((pfnDbgkpSetProcessDebugObject)DbgkpSetProcessDebugObject)(object, debugobject, status, LastThread);

}
else{

status = STATUS_PROCESS_IS_TERMINATING;

}
ExfReleaseRundownProtection((PEX_RUNDOWN_REF*)(object + 376));



}


return status;
}

今天先发一个

0 0